
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
react-native-heap-profiler
Advanced tools
A fast way to take a Hermes heap profile from javascript in React Native. Inspired by react-native-release-profiler.
npm install react-native-heap-profiler
yarn add react-native-heap-profiler
import {
getHeapInfo,
createHeapSnapshot,
measureAllocationSize
} from 'react-native-heap-profiler';
// Run `npx react-native-heap-profiler --appId=com.your.app.id --outputDir=/path/to/output`
// to get the heap snapshot from your android device (dev only)
const path = createHeapSnapshot();
// Get realtime heap information from hermes (works in production)
const heapInfo = getHeapInfo(path);
console.log(heapInfo.hermes_allocatedBytes);
// Logs the number of bytes allocated by the function (works in production)
const allocationSize = measureAllocationSize(() => {
new Array(1000000);
});
import { createHeapSnapshot } from 'react-native-heap-profiler';
createHeapSnapshot();
Android:
First find your app id. It should look something like com.mypackage and be visible in app/build.gradle in the defaultConfig section:
android {
defaultConfig {
applicationId "com.profilern" // <-- This one!
// ...
}
}
Then you can run this command:
npx react-native-heap-profiler --appId=com.your.app.id --outputDir=/path/to/output
iOS:
On iOS you can use react-native-share
to share the file to your computer:
if (Platform.OS === 'ios') {
const path = createHeapSnapshot();
const actualPath = `file://${path}`;
try {
await Share.open({
url: actualPath,
title: 'Save heapsnapshot',
type: 'application/json',
});
} catch (error) {
// An error is thrown when the user doesn't share, but we catch
// this since that is fine
}
}
HermesHeapInfo
TypeFields returned from hermes when getting heap information. hermes_allocatedBytes
represents the current number of allocated bytes in the heap.
export interface HermesHeapInfo {
hermes_allocatedBytes: number;
hermes_externalBytes: number;
hermes_full_gcCPUTime: number;
hermes_full_gcCPUTimeSquares: number;
hermes_full_gcMaxCPUPause: number;
hermes_full_gcTime: number;
hermes_full_gcTimeSquares: number;
hermes_full_maxPause: number;
hermes_full_numCollections: number;
hermes_heapSize: number;
hermes_mallocSizeEstimate: number;
hermes_numCollections: number;
hermes_numMarkStackOverflows: number;
hermes_peakAllocatedBytes: number;
hermes_peakLiveAfterGC: number;
hermes_totalAllocatedBytes: number;
hermes_va: number;
hermes_yg_gcCPUTime: number;
hermes_yg_gcCPUTimeSquares: number;
hermes_yg_gcMaxCPUPause: number;
hermes_yg_gcTime: number;
hermes_yg_gcTimeSquares: number;
hermes_yg_maxPause: number;
hermes_yg_numCollections: number;
}
createHeapSnapshot(): string
(Dev only!)
Takes a heap snapshot and returns the path to the snapshot file. See the usage section above for details
const pathToFile = createHeapSnapshot();
getHeapInfo(includeExpensive: boolean): HermesHeapInfo
Request statistics about the current state of the runtime's heap. This function can be called at any time, and should produce information that is correct at the instant it is called (i.e, not stale). Works in production and development.
const heapInfo = getHeapInfo(true);
console.log(heapInfo.hermes_allocatedBytes); // 123456
measureAllocationSize(f: () => any): number
Compares the number of bytes allocated before and after a function call and returns the difference. This is useful for measuring the size of objects. Note that this function runs garbage collection before the function, so the results should be quite stable. Still, it is best to average a series of many measurements and exclude outliers. Works in production and development.
const allocationSize = measureAllocationSize(() => {
const trie = new Trie();
for (const word of ['a', 'ab', 'abc', 'abcd', 'abcde', 'abcdef' /* ... */]) {
trie.add(word);
}
});
console.log(allocationSize); // 1152640
See the contributing guide to learn how to contribute to the repository and the development workflow.
MIT
Made with create-react-native-library
FAQs
Heap profiler for react-native
The npm package react-native-heap-profiler receives a total of 6,183 weekly downloads. As such, react-native-heap-profiler popularity was classified as popular.
We found that react-native-heap-profiler demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.